Install and verify

Before you can protect anything, you need a CLI you can trust. This page takes you from the public download mirror to a verified trustplane --help, then shows you how to pin the container images, Helm chart, and SDKs that go with it.

If you want the short story of what TrustPlane Auth protects before installing anything, read What is TrustPlane Auth? first.

Current release

The current TrustPlane Auth CLI release is v0.2.4; trustplane enroll requires v0.2.1 or later. v0.2.4 archives are published as trustplane_v0.2.4_<os>_<arch>.tar.gz with SHA256SUMS and a machine-readable release-manifest.json; checksum verification is mandatory before use. Every artifact is version-pinned.

What you will install

Artifact	What to use	Pinning rule
CLI	trustplane archive from the public downloads mirror	Verify SHA256SUMS before unpacking or running it.
Adapter image	GHCR trustplane-auth-adapter image	Use the documented version tag plus digest.
Helm chart	oci://ghcr.io/trustplane-dev/charts/trustplane-auth	Use chart version 0.2.2 and digest-pinned images.
Go SDK	github.com/trustplane-dev/trustplane-auth-sdk-go module	Pin v0.2.2 explicitly.
TypeScript SDK	npm package @trustplane/auth-sdk	Pin 0.2.2 explicitly. Node.js-only.
Python SDK	PyPI distribution trustplane-auth-sdk	Pin 0.2.2 explicitly. Caller-side only.

Do not use a mutable latest tag or unpinned chart version.

Choose your CLI archive

The v0.2.4 public downloads base is:

https://downloads.auth.trustplane.dev/trustplane/v0.2.4/

Archive names use this pattern (the release-manifest.json in the same directory lists the full archive set with per-archive SHA-256 values):

trustplane_v0.2.4_<os>_<arch>.tar.gz

Use the archive that matches your machine:

Platform	Archive guidance
macOS Apple Silicon	trustplane_v0.2.4_darwin_arm64.tar.gz
macOS Intel	trustplane_v0.2.4_darwin_amd64.tar.gz
Linux x86_64	trustplane_v0.2.4_linux_amd64.tar.gz
Linux arm64	trustplane_v0.2.4_linux_arm64.tar.gz

The current release does not include Windows artifacts.

Download the checksums and your archive

Set the archive name first, then download SHA256SUMS and the matching archive:

VERSION=v0.2.2
BASE_URL="https://downloads.auth.trustplane.dev/trustplane/${VERSION}"
ARCHIVE="trustplane_${VERSION}_darwin_arm64.tar.gz"

curl -fsSLO "${BASE_URL}/SHA256SUMS"
curl -fsSLO "${BASE_URL}/${ARCHIVE}"

Replace ARCHIVE with the macOS or Linux file from the table above.

Verify the checksum before install or use

Verify the archive checksum before unpacking or running anything from the archive:

grep "  ${ARCHIVE}$" SHA256SUMS | shasum -a 256 -c -

On Linux, sha256sum is also fine:

grep "  ${ARCHIVE}$" SHA256SUMS | sha256sum -c -

If the checksum does not match, stop and download the files again.

Unpack and verify the CLI starts

For macOS and Linux:

tar -xzf "$ARCHIVE"
./trustplane --help

trustplane --help is the first local verification point. It confirms that the checked archive contains a runnable TrustPlane Auth CLI for your platform.

Pin the images and chart

The adapter image is a public GHCR artifact and should be referenced by version tag plus digest. The Helm chart is available at:

oci://ghcr.io/trustplane-dev/charts/trustplane-auth

Use chart version:

0.2.2

Keep the chart version pinned and keep image references digest-pinned. The exact image digests, chart commands, and release-channel details live in Install and artifacts.

Install an SDK

The SDK modules are caller-side: they sign proof-bound requests, enroll workload keys through TA-G1 public auto-enrollment, and speak broker IPC v1 from caller code, returning adapter-ready TrustPlane headers. They are not verifiers, Control admin API clients, gateway plugins, broker runtimes, or policy distribution paths.

go get github.com/trustplane-dev/trustplane-auth-sdk-go@v0.2.2
npm install @trustplane/auth-sdk@0.2.2

The TypeScript SDK is Node.js-only in the current release. The Python SDK is also released (python -m pip install trustplane-auth-sdk==0.2.2). See Go SDK, TypeScript SDK, Python SDK, and SDK contract for scope and conformance notes.

Next steps

With a verified CLI in hand, you can start putting TrustPlane Auth to work:

• Run the local proof-bound request flow end to end in Run the local flow.
• Walk through Protect your first API when you are ready to put the adapter in front of an existing service.
• Browse the use cases overview to understand same-cluster SPIFFE, software/JWKS, and cross-environment caller patterns.
• Put the adapter directly in front of an API endpoint. Existing gateways such as Envoy, NGINX, and Kong are relevant integration targets, but gateway-specific templates are adoption accelerators, not required for the core verifier model. See Gateway integration patterns for the current adapter-routing shape.
• Use the route policy map to understand which source rules can call which routes.

For what the current release covers and what is planned, see Scope.